Preventing and reporting a data breach
You must protect the personal data of your customers and business partners. If others access this personal data without permission or without intent, then you have a data breach. You may need to report the data breach to the Dutch Data Protection Authority (AP) and the affected people.
What is a data breach?
A data breach occurs when someone gains unauthorised access to personal data. This can happen either deliberately or accidentally. For example, if:
- cybercriminals hack your systems
- you send an email with private data to the wrong person.
- a laptop with customer data goes missing.
You may also have a data breach if personal data is deleted or changed by accident. For example, you may no longer be able to access customer data because it has been encrypted as a result of a cyberattack.
Data breach caused by the use of AI tools
A data breach can also occur when employees use personal data in generative AI models. Under the GDPR, you, as an employer, are responsible for how your employees process personal data in the course of their work. Entering personal data into an AI tool also constitutes processing. It does not matter whether the tool stores the data or not.
You can limit the risk of a data breach caused by the use of AI tools by drawing up an AI policy. In this policy, you should, for example, clearly set out:
- which AI tools may or may not be used
- which data may or may not be used in AI tools
- the purposes for which the AI tools may be used
In addition, ensure AI training and awareness amongst your employees.
Reporting a data breach
Whether you need to report a data breach depends on the risk to those affected. If there could be consequences for the people whose data has been leaked, you must report it. For example:
- Criminals have gained access to the data. This leaves those affected vulnerable to phishing or identity fraud.
- An employee accesses a medical record without authorisation.
- Sensitive data has been sent to the wrong recipient. This could damage the victim’s reputation.
If you are unsure whether there are any consequences for the individuals whose data has been leaked, it is best to report the data breach.
Check with the AP if you need to report a data breach
You must report the data breach within 72 hours
As soon as you discover the data breach, you must report it to the Dutch Data Protection Authority (AP) within 72 hours. If you fail to report the data breach when you are required to do so, the AP may impose a fine.
Reporting a data breach to the AP (in Dutch)
Reporting a data breach to your clients
Do you process sensitive personal data for others? If so, you must report all data breaches to your clients so that they can pass this on to the AP.
Obligation to report? Inform the affected people as well
If you must report the data breach to the AP, you must also let the people know what has happened to their personal data. Then they can protect themselves as quickly as possible. For example, by:
- changing their passwords
- blocking an account
- being extra watchful about suspicious phone calls or emails
Read how to inform data subjects about a data breach.
Sometimes, you do not need to inform those affected. For example, if the personal data is encrypted and the key is still secure, or if there is no longer any risk to the victims.
Check if you need to inform the victims or not
Always record a data breach
You must always keep a record of any data breaches you have experienced. Also if you are not required to report them to the Data Protection Authority or the affected individuals. The General Data Protection Regulation (GDPR) sets this out. You can do this in a data breach register. You should record:
- exactly what happened
- what the results are
- what you did after you found the data breach
Read more about keeping a data breach register
How can you recognise a data breach?
There are signs that may indicate a data breach. These include:
- suspicious login activity or unusual file changes
- the unexpected appearance of unknown files
- files being deleted by someone without authorisation
- administrator activity that differs from the norm
- alerts from your antivirus software regarding suspicious network traffic or suspicious software
Prevent a data breach
There are several steps you can take to stop a data breach.
Only collect the information you need, and think about whether you really need to store it. Delete any data you no longer need. If another business processes personal data or sensitive information for your business, draw up a data processing deal.
Store sensitive data in as few places as possible, and thoroughly check the systems you use to store data. You can also use Data Loss Prevention (DLP) software to provide extra protection for your data. DLP software allows you to sort and manage sensitive data.
Tips for preventing a data breach (in Dutch)
It is important that your staff:
- are aware of the risk of a data breach
- know how to handle personal data
- know what to do if they have leaked data
Also, keep track of which staff members have access to confidential information, and ensure that staff only have access to the data they need for their work.
Useful tools for preventing data breaches
Prepare for a cyber incident with cyber exercises
Practise with your staff what to do in the event of a cyber incident. There are various exercises you can carry out. The National Cyber Security Centre (NCSC) explains how to practise for a cyber incident.
Preventing data breaches involving stolen or lost devices
You can take several steps to stop a data breach, for example, if devices are stolen or go missing. Check the advice from the National Cyber Security Centre (in Dutch).
How can you run your business securely and resiliently?
The more specialised, innovative, and unique your company's knowledge or product is, the more attractive you are to others, both at home and abroad. As well as data breaches, there are other risks to your business. Use the ‘Weerbaarwijzer’ (in Dutch) to find out what you can do to run your business securely and resiliently.